django CMS: Structure endpoint bypasses page-view permission
Summary
The structure-board endpoint (render_object_structure) renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via render_page(), but the structure endpoint does not, allowing a low-privileged staff user to read the plugin structure of a view-restricted page.
Details
render_object_structure (in cms/views.py) loads the PageContent object and renders cms/toolbar/structure.html directly. Unlike render_object_endpoint (used by edit/preview), which renders through render_pagecontent → render_page and calls user_can_view_page(request.user, page) (returning 404 when the user may not view the page), the structure endpoint performs no page-level authorization.
The rendered structure board includes each plugin's get_short_description() (e.g. link names/URLs, text snippets), so the content of a restricted page is disclosed, not just its shape.
Impact
A staff user (any account with is_staff=True) who lacks view permission on a view-restricted page can retrieve that page's plugin structure and short descriptions by requesting the structure endpoint with the page's content-type id and object id.
This only applies when CMS_PERMISSION=True and the page has view restrictions (or CMS_PUBLIC_FOR='staff'). Sites without per-page view restrictions are not affected.
Patches
Fixed in 5.0.8: the structure endpoint now enforces user_can_view_page() for PageContent objects, matching edit/preview.
Workarounds
None other than restricting staff access. Upgrade is recommended.
Credits
Reported by the security team at the University of Sydney ([@reporter]).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | django-cms | < 5.0.8 | 5.0.8 |
References
- https://github.com/django-cms/django-cms/security/advisories/GHSA-vgxm-h9gx-h9w7
- https://github.com/django-cms/django-cms/pull/8645
- https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c
- https://github.com/django-cms/django-cms
- https://github.com/django-cms/django-cms/releases/tag/5.0.8
- https://pypi.org/project/django-cms
- https://github.com/advisories/GHSA-vgxm-h9gx-h9w7
- https://nvd.nist.gov/vuln/detail/CVE-2026-54624
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-285, CWE-862- Platform
- Python (PyPI)
- Package
django-cms- Disclosed
- 20.08.2026
- Updated
- 11.10.2026 15:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3826 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-vgxm-h9gx-h9w7 - CC BY 4.0
Vulnerability history: django-cms
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 10
- First → latest
- 08.2017 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 8
Disclosures per year
- 2017: 1
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 7
-
django CMS: Structure endpoint bypasses page-view permission this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.